Description

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-19T06:17:35.730Z",
  "pubdate": "2026-08-19T06:17:35.730Z",
  "executiveSummary": "The Product Shortlist WordPress plugin through 1.0.4 suffers from an unauthenticated SQL injection vulnerability, arising from improper sanitisation and escaping of user-supplied input prior to inclusion in a database query. This security defect enables remote, unauthenticated threat actors to execute arbitrary SQL commands directly against the underlying database management system. The business impact of this vulnerability is critical, as successful exploitation may lead to unauthorized data extraction, including sensitive application data, user credentials, or database contents. Furthermore, depending on database configuration and privileges, this flaw could potentially facilitate privilege escalation or remote code execution within the hosting environment. Exploitation requires network access to the vulnerable WordPress instance and involves sending a crafted HTTP request containing malicious SQL payloads directed at the vulnerable parameter, with no prior authentication or administrative privileges required by the attacker.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Product Shortlist WordPress plugin to adequately sanitise and escape input parameters before incorporating them into a dynamic SQL statement. Input handling mechanisms lack robust parameterization or proper data type validation, allowing raw user input to directly manipulate the syntax and logic of the database query executed by the application backend.\nThe vulnerability resides within the request handling and query generation components of the plugin. Specifically, an input parameter processed by the application is accepted from HTTP requests without undergoing rigorous validation or secure escaping routines. When the application constructs the database query using string concatenation or insecure interpolation, the untrusted input directly alters the intended query structure.\nAttack flow begins with an unauthenticated attacker identifying the vulnerable parameter exposed by the Product Shortlist WordPress plugin. The attacker crafts a specialized HTTP request containing a malicious SQL payload designed to manipulate the query logic, such as introducing UNION-based operators, boolean-based conditional inferences, time-based delays, or error-based extraction techniques. Upon receipt, the vulnerable component processes the request and executes the modified SQL statement against the underlying database.\nThe affected component operates with the database privileges assigned to the WordPress database user, which typically possess broad read and write capabilities over the application schema. Consequently, the payload behavior can range from retrieving sensitive records from database tables to modifying or deleting data. Post-exploitation impact includes complete confidentiality compromise of the database contents, potential integrity degradation, and secondary attacks against the underlying web server infrastructure if administrative database functions are accessible."
}